golem15/msd-core
4
0
Fork 0
Code Issues 1 Pull Requests Actions 3 Packages Projects Releases Wiki Activity

fix(#3504): harden hook injection patterns and force-add guard (#3510)

Browse Source 
* test(#3504): add failing-first parity, fail-closed, and bypass suites

* fix(#3504): harden hook injection patterns and force-add guard

* test(#3504): stage the scanner lib dependency in shared-hooks fixture

* chore(#3504): backfill changeset pr number

* test(#3504): build parity samples from fragments for the ci scan

---------

Co-authored-by: sim <sim@local>
This commit is contained in:
Tom Boucher
2026-08-14 21:19:35 -04:00
committed by GitHub
parent e57918a648
commit 268ca7e32d
24 changed files with 659 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
tests/shared-hooks-dir-resolution.test.cjs
View File

@@ -589,6 +589,18 @@ describe('GROUP C: bundle-directory-name-agnostic hook scripts', () => {
fs.mkdirSync(bundleDir, { recursive: true });
const scannerPath = path.join(bundleDir, 'gsd-read-injection-scanner.js');
fs.copyFileSync(path.join(REPO_ROOT, 'hooks', 'gsd-read-injection-scanner.js'), scannerPath);
// #3504: the scanner now requires hooks/lib/injection-patterns.js. Every
// real staging surface ships lib/ alongside the hook (installSharedHooksBundle
// copies dist recursively AND stages hooks/lib from the GSD_HOOK_LIB_FILES
// allowlist into the same shared dir), so this lone-file emulation must
// stage the dependency the same way — a missing lib file is a packaging
// bug that fails loud at hook load (#2587), which is exactly what the
// un-staged version of this fixture now demonstrates.
fs.mkdirSync(path.join(bundleDir, 'lib'), { recursive: true });
fs.copyFileSync(
path.join(REPO_ROOT, 'hooks', 'lib', 'injection-patterns.js'),
path.join(bundleDir, 'lib', 'injection-patterns.js'),
);
// Node canonicalizes a module's __dirname via the REAL (symlink-resolved)
// path, so a payload path must be built from the same realpath — on macOS